This applies to every Outer-Void repository that does not have its own SECURITY.md.

Report privately by e-mail to outervoid.blux@gmail.com (fallback: theoutervoid@outlook.com) with "SECURITY" in the subject. Do not open a public issue for a vulnerability.

Include the repository and commit, what an attacker can do, and the steps to reproduce. Do not include real user data, credentials or device identifiers; describe them instead. You will get an acknowledgement, and a fix or a decision with reasons.

• Leaked credentials or signing keys are treated as compromised immediately and rotated.
• Device-affecting software (VoidForge) and anything that handles money (Roughin), care data (Vigyl) or moderation (Resolver) is treated with the highest priority.
• Most Outer-Void source is proprietary. Reporting a vulnerability does not grant a licence to the code.